> LineageOS really should be based directly on GrapheneOS
I get the point you're trying to make, but in reality, it wouldn't be very useful. Many security features of GrapheneOS could easily be bypassed, due to flaws in LineageOS, such as the fact that they ship userdebug instead of production builds, don't really allow for bootloader relocking, etc. High-level improvements like the GrapheneOS hardened memory allocator, Auditor app (hardware-based remote attestation/device integrity monitoring), etc. are pretty useless, when the entire system has an unlocked bootloader and thus no verified boot, weakend SELinux policies due to the use of userdebug builds, etc. GrapheneOS also purposely narrows the list of supported devices for security reasons. They mandate a high-quality secure element, hardware memory tagging, etc. whereas LineageOS tries to support as many devices as possible. Those two very different philosophies simply aren't compatible.
I get the point you're trying to make, but in reality, it wouldn't be very useful. Many security features of GrapheneOS could easily be bypassed, due to flaws in LineageOS, such as the fact that they ship userdebug instead of production builds, don't really allow for bootloader relocking, etc. High-level improvements like the GrapheneOS hardened memory allocator, Auditor app (hardware-based remote attestation/device integrity monitoring), etc. are pretty useless, when the entire system has an unlocked bootloader and thus no verified boot, weakend SELinux policies due to the use of userdebug builds, etc. GrapheneOS also purposely narrows the list of supported devices for security reasons. They mandate a high-quality secure element, hardware memory tagging, etc. whereas LineageOS tries to support as many devices as possible. Those two very different philosophies simply aren't compatible.